Malware

Bankshot

Also known as: COPPERHEDGE · FoggyBrass

Indicators of Compromise 6

Domain jshosting[.]me Filename SearchHost.exe Filename inet.tmp Filename net.tmp Filename task.vbs IP 176[.]65[.]128[.]26

MITRE ATT&CK TTPs 11

T1001.001
Junk Data
Command And Control
 T1021.001
Remote Desktop Protocol
Lateral Movement
 T1055
Process Injection
Defense Evasion
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1078
Valid Accounts
Defense Evasion
 T1085
T1085
 T1098
Account Manipulation
Persistence
 T1189
Drive-by Compromise
Initial Access
 T1203
Exploitation for Client Execution
Execution

Source Articles

Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts
A state-sponsored threat actor has conducted a campaign exploiting a zero-day buffer overflow vulnerability in AnySign4PC, a South Korean financial-security software, through compromised legitimate websites used as watering holes. The attack allows remote code execution without user interaction by leveraging malicious WebSocket communication and DLL side-loading, leading to the deployment of SIGNBT or COPPERHEDGE backdoors. These backdoors enable remote command execution, file theft, reconnaissance, and lateral movement using tools like Mimikatz and RDP. The campaign overlaps technically with Gunra ransomware operations in infrastructure and artifacts, though no formal attribution to a specific group like Lazarus is made in the joint advisory.
hacker-news ·5h ago